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On the Systematic Constructions of Rotation Symmetric Bent 
Functions with Any Possible Algebraic Degrees 
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Abstract 

In the literature, few constructions of n-variable rotation symmetric bent functions have been pre¬ 
sented, which either have restriction on n or have algebraic degree no more than 4. In this paper, for any 
even integer n = 2m > 2, a first systemic construction of n-variable rotation symmetric bent functions, 
with any possible algebraic degrees ranging from 2 to m, is proposed. 
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1 Introduction 

Boolean bent functions were introduced by Rothaus in 1976 [13]. Let F 2 be the finite field with two 
elements, n > 0 be a positive integer, and F£ be the n-dimensional vectorspace over F 2 . An n-variable 
Boolean function from F£ to F 2 is bent if it has maximal Hamming distance to the set of affine Boolean 
functions. Boolean bent functions have attracted much attention due to their important applications in 
cryptography ESI. coding theory and sequence design mmm- 

Boolean functions that are invariant under the action of cyclic rotation on the inputs are called rotation 
symmetric functions m- Such class of Boolean functions is of great interest since they need less space 
to be stored and allow faster computation of the Walsh transform. Further, it has been experimentally 
demonstrated that the class of rotation symmetric functions is extremely rich in terms of cryptographically 
significant Boolean functions. In particular, they allowed obtaining Boolean functions in odd numbers of 
variables beating the best known nonlinearities [7], and new bent functions (in even numbers of variables) 

mmmn. 

Throughout this paper, for n = 2m we study the n-variable rotation symmetric bent functions. To avoid 
confusion, we denote the sum over Z by +, and the sum over F 2 by ©. The quadratic Boolean function 

m —1 

/ 0 O 0 , ‘ , X n -l) = @ XiXm+i (1) 

i=0 

is the first class of rotation symmetric bent functions. According to experimental results, Stanica et al. 
conjectured that there is no homogeneous rotation symmetric bent function having algebraic degree greater 
than 2 |14j . Since then, large classes of homogeneous rotation symmetric functions seem to support the 
conjecture since all of them do not contain non-quadratic bent functions mm- 

As any theoretic advancement in this direction can be used to find cryptographically significant functions 
on higher number of variables, it was stated in M that any theoretic construction of rotation symmetric 
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bent functions with algebraic degree larger than 2 is an interesting problem. In the literature, the main 
method of constructing new rotation symmetric bent functions is to modify fo(x) in ([I]) [3] [6]. Up to now, 
only few constructions of rotation symmetric bent functions are known, whose algebraic degrees are all no 
more than 4. In 0, for n = 2m, Gao et al. proved the cubic rotation symmetric function 

m— 1 n— 1 

ft{xQi 5 X n — l) — 

i— 0 i=0 

is a rotation symmetric bent function if and only if act ^ n is odd, where 1 < t < m — 1 and the subscript of 
x is modulo n. This is the first theoretical construction of rotation symmetric bent functions with algebraic 
degree lager than 2. Recently, another n- variable cubic rotation symmetric bent function 

m— 1 n— 1 2r—1 

f {X01 ‘ ‘ * 5 X n — 1) — XiXm-\-i © XiX r -\-iX2r-\~i © XiX2r-\-%X4r-\-i i 

2=0 2=0 2=0 

where n = 2m = 6r, was presented in [3]. Later on, an infinite class of n- variable rotation symmetric bent 
functions with algebraic degree 4, where n = 2 to but not divisible by 4, was constructed from two known 
semi-bent rotation symmetric functions in to variables with complementary Walsh supports [2] . 

In this paper, we present a simple but generic construction of n-variable rotation symmetric bent functions 
still by the modification of the quadratic rotation symmetric bent function /o in CD- Unlike the previous 
modifications, our construction can provide n-variable rotation symmetric bent functions for any even integer 
n. Most notably, the proposed n-variable rotation symmetric bent functions can have any possible algebraic 
degree ranging from 2 to n/2. To the best of our knowledge, it is the first time to construct rotation 
symmetric bent functions of algebraic degree larger than 4 when n > 10. 

The rest of this paper is organized as follows. In Section 2, some basic notations and definitions of 
Boolean functions, rotation symmetric bent functions in particular, are reviewed. In Section 3, a generic 
construction of n-variable rotation symmetric bent functions is proposed by modifying the support of the 
quadratic rotation symmetric bent function /o in CD • In Section 4, a flexible construction of n-variable 
rotation symmetric bent functions with any given algebraic degree from 2 to n/2 is presented. Finally, 
Section 5 concludes this paper. 

2 Preliminaries 

Given a vector x = (xo, • • • , x n _i) £ FJ?, define its support as the set supp(x) = {0 < i < n \ Xi = 1}, 
and its Hamming weight wt(x) as the cardinality of its support, i.e., wt(x) = |supp(x)|. 

In this paper, for simplicity, we do not distinguish the vector x = (xo, • • • ,x n _i) £ and the integer 
Y^i=o Xi 2* £ {0, ■ • ■ , 2 n — 1} if the context is clear, since they are one-to-one corresponding. For any two 
vectors x = (xo, • • • , x n -i) £ F 2 and y = (j/o, • • • , y n - 1 ) £ F£, if x, < yi for all 0 < * < n, then we say that 
y covers x and denote it by y >2 x. According to Lucas formula, we have 

= 1 (mod 2) y h x. (2) 

Let x = (xo, • • • ,x„_i) £ Fg. For two integers l > 0 and 0 < i < n, define the left Z-cyclic shift version 
of vector x as p/(x) = (p/(x 0 ), • • • ,p/(x n _i)) by 

P?(xi) = x i+ i, 

where the subscript of x is modulo n. An orbit generated by a vector x £ F 2 is defined as 

O n (x) = |po(x),--- ,p^_i(x)}. 



( 3 ) 



In other words, each orbit consists of all cyclic shifts of one vector in FJ. Naturally, an orbit in can 
be represented by its representative element which is the lexicographically first element belonging to the 
orbit. The set of the representative elements of all the orbits in is denoted by R n . For example, 
R 4 = {(0,0,0,0), (1,0,0,0), (1,1,0,0), (1,0,1,0), (1,1,1,0), (1,1,1,1)}. 

An n -variable Boolean function is a mapping from Fl{ into F 2 . We denote by B n the set of all the n- 
variable Boolean functions. A basic representation of a function / £ B n is by the output of its truth table, 
i.e., a binary vector of length 2 n , as 


/ = [/(0), • • • ,/(2"-l)]. 

The support of / is defined as supp(/) = {x £ F£ | f(x) = 1} and / is also said to be the characteristic 
function of the set supp(/). The Hamming weight of / is the cardinality of supp(/), i.e., wt(/) = |supp(/)|. 
It is easy to see that supp(/ 0 ) = 0 4 ( 1, 0,1, 0) U 0 4 (1,1,1,0) and wt(/o) = 6 for f 0 in {T} when n = 4. 

The most usual representation of a Boolean function / £ B n is the algebraic normal form (ANF) as 

f(x ) = (D c a x a , c a £ F 2 , (4) 

where c a is the coefficient of the term x a = Xq° ■ ■ ■ for x = (xq, • • • , x n -i) and a = (ao, ■ ■ • , a n -i) 

in ¥!f. The algebraic degrees of the term x a and the Boolean function / in (Q| are respectively defined as 
deg(x“) = wt(a) and 


deg(/) = max{wt(a) | c a = 1, a £ Fl(}. 


Specifically, the Boolean functions of degree at most 1 are called affine functions; the function / in (U) is 
called to be homogeneous if all the terms with nonzero coefficients in / have the same algebraic degree. 

Definition 1. For a function f £ B n , if f(pf(x)) = f(x) holds for all inputs x £ F 2 and integers 1 < l < 
n — 1, then f is called a rotation symmetric function. That is, rotation symmetric functions are invariant 
under cyclic rotation on inputs. 

The Walsh transform of an n- variable Boolean function / is an integer-valued function on F£, whose 
value at a £ Fj is defined as 

W f (a) = (-l) /(x)0a ' a: (5) 

XGF2 

where a-x = aoXo©- • •©«„_ix n _i is the usual inner product of a = (ao, ■ • • , a n -i) and x = (xo, • • • , x n -i). 
The nonlinearity of a function / £ B n is given by nl(f) = 2 n ~ 1 — i max |W/(a)|. 

Definition 2. A Boolean function f : F 2 —» F 2 is said to be bent ifWf(a) = ±2^ for all a £ Fj. 

Obviously, an n-variable Boolean function is bent only if n is even. In addition, it is well known that 
the algebraic degree of an n-variable bent function is no more than m for n = 2m > 4, while the algebraic 
degree of a 2-variable bent function is 2. 

The following result will be used in the computation of the values of the Walsh transform later. 


Lemma 1. Let a,b be two vectors over FJJ. Then, 

£(-i>’ 


ieGR? 


a = b 
otherwise 


where b = (b 0 ® 1 , • • ■ , 6 „_ 1 © 1 ) for b = ( 6 0 , ■ , b n - 1 ). 


2 n , 

0 , 


Proof. For any two vectors a,b £ ¥ r f . 


E 


(-i) 


x-(x®a©6) 


^_ 1 ^-((l,---,l)©a©6) 

X(zW2 

I 2 n , a = b 
I 0, otherwise 


where the first identity holds since x ■ x = wt(x) = x ■ (1, • • • ,1), and the second identity holds by the fact 
that J2 (-l) A ' y = 2 n if A = 0 and £ (-1) A ^ = 0 if A <E F£ \ {0}. □ 

From now on, we always assume n = 2m > 2. For a vector x = (xo> • • • , x n -i) £ , we always denote 

x' = (x 0 , • • • ,x m _i), x" = (x m , ■ ■ ■ ,x n -i), x' ■ x" = x 0 x m ® ■ • • ® and x' * x" = x 0 x m H-h 

x m -iX n -\. Obviously, x' * x" = 0 if and only if XiX m +i = 0 for 0 < i < m — 1. For simplicity, we use the 
notation x' + x" for x' © x" satisfying x' * x" = 0. This is to say, when x' + x" is used in the rest of this 
paper, it always implies x' * x" = 0. 


3 A generic construction of rotation symmetric bent functions 


In this section, we present a generic construction of rotation symmetric bent functions by modifying the 
support of fo(x) in ([]]). 

Given a subset TCF", define an n- variable Boolean function as 


f(x) 


fo{x) © 1, x £T 
fo(x), otherwise 


( 6 ) 


where /o is given in ©■ In order to construct an n- variable rotation symmetric bent function / in (J6]), it is 
crucial to choose a proper subset T of F£. 

Firstly, we give a sufficient and necessary condition of T such that / in P is a rotation symmetric 
function. 


Lemma 2. The n-variable Boolean function f in © is a rotation symmetric function if and only if O n (x) C 
T for all x £ T. 

Proof. Recall that fo is a rotation symmetric function. Let xt(') be the characteristic function of T. Then, 
by Definition [I] / is a rotation symmetric function if and only if \t = / © /o is also a rotation symmetric 
function, which is equivalent to pf{x) £ T for all x £ T and 1 < l < n. This completes the proof by the 
definition of O n (x) in ©. □ 

Secondly, we study a sufficient condition of T such that / is a bent function. 

Lemma 3. For any subset T C F™, if the subset 

T= U {x£¥ n 2 \x' £W?,x" = x'@ 1 ), (7) 

7er 

then the n-variable Boolean function f in © is a bent function. 


Proof. Substituting / to the definition of the Walsh transform in ([5]), we have 


x)®l®a:-x 


W f (a) = (-l) /o(x) ®“' a; + ^(-l) /o(l 

xew%\T xer 

_ ^ ^ ^_^x'-x"(B&'-x'tBoi"-x" 2 ^ ^ l) x '‘ a 

xe¥% xeT 

_ ^ ^ ^ ’x" ^ ^ _ 2 ^ ^ ^_^x'-(x / ®7)®Q:'-a;'®Q: // -(a; / ®7) 

-yerx'ew™ 


x"(z.F'% 


tc'GF^ 


= (- 1 ) 


a-.a ' 2 m _ 2 V(-l)“"' 7 




E 


(- 1 ) 


^ /- ( a ' / ®7® Q:/ ® Q:,/ ) 


7GT x'CFip 

(- 1 ) 1 +a'-a" 2 m ) if a'$ a " = ^f or a 7 g T 
(—l) a 2 m , otherwise 


where the fourth identity comes from the fact that Y1 (—1) A v = 2 m if A = 0 and )T) (—1) A v 

y£F™ y£V™ 

A £ F™ \ {0}, the last identity follows from Lemma [T] 

The following result is immediate from Lemmas [5] and [3] 


0 if 

□ 


Theorem 1. The n-variable Boolean function defined in © is a rotation symmetric bent function if the 
subset T C FJ satisfies O and O m {pf) C T for all 7 gT. 

Proof. According to 0, x = ( x 0 , • ■ • ,x n _i) £ T if and only if x i+m = x t © 7*, i.e., Xi +i+m = Xi +i ® 7 i +i , 
for all 0 < * < n and 1 < l < n, where 7 = (70,- •• , 7m-i) £ L. Then, given 1 < l < n, p™(x) = 
{xi, ■ ■ ■ ,xi +n - 1) £ T if and only if p™^) = (7;, • • • ,7i +m _i) £ T, i.e., 0 „( x) C T if and only if O m (7) C T. 
Hence, / in © is a rotation symmetric bent function by Lemmas [ 2 ] and [ 3 ] □ 

In what follows, we investigate the ANF of the function proposed in Theorem [Q To do so, it is sufficient 
to determine the ANF of the characteristic function \t- 
Given a 7 £ R m , define 


T 7 = (J {x£F2|a;'£F™,:r"=:r'©<5}. (8) 

seo m h) 

It is easy to see that the subset T 7 of FJ in ([ 8 ]) satishes: 

PI T a fl Tp = 0 if a /3, where a, f3 £ R m . 

Example 1. If n = 4, the vector sets T 7 , 7 £ R 2 , are given in Table [7J 


Table 1: The vector sets T 7 for 7 £ R 2 


7 

t 7 

(0,0) 

0 4 (0,0,0,0) u o 4 (i, 0,1,0) u o 4 (i, 1,1,1) 

(1,0) 

0 4 (1,0,0,0)U0 4 (1,1,1,0) 

(1,1) 

0 4 (1,1,0,0) 


Since O m ( 7 ) C T for all 7 £ T, then we can write T as T = (J O m ( 7 ) and then 

7 £R m nr 

T= (J T 7 . 

7 eR m nr 







By PI, we have 


XT 0)= ® XT 7 (x) 

7 eR m nr 


(9) 


where \t(-) is the characteristic function of T. Therefore, we study the ANF of the function xt~ firstly. 
Lemma 4. The ANF of the n-variable characteristic function of T 7 in ([SI) is 


© 

© ^ 

(10) 

S&Omh) 

P'+/3"hS 


© ^ 

© ** 

(11) 

<5<ER m 

sy-y 

p'+p "eo m (S) 



where c$ € { 0 , 1 } with c 7 = 1 . 


Proof. First of all, we prove (flUl) in two special cases: 7 = 0 m and 7 = \ m where 0 m and l m respectively 
denote the all-zero and all-one vector of length to. 

According to the definition of characteristic function, we have 


and 


m—1 

XT lm {x) = © (Xi © bi © l)(x m +i © bi) 

(b 0 ,-, 6 m-i)eiT i=0 

m—1 

= n( © {Xi © bi © 1)(^m+i © 

<=o bie{ 0,1} 

m—1 

11 {Xi © ^m+ 2 ) 

2=0 

m—1 

® n x i ix t+i 

0 < 2 <m 2=0 

fli GF 2 ,/3j+/3 m _)_i =1 


m —1 

XT 0m (x) = © n (x» © bi ® l)(ar m+j 0 bi 0 1) 

(i.o,---,bm-i)€F™ i=0 
m —1 

J ^ (x i 0 6 i 0l)(a: m+i ©6 i ©l)) 

*=0 6 ie{o,i} 
m —1 

= JJ (®i © %m+i © 1) 

2=0 

m —1 

© n x i‘ x ™+i 

0 < 2 <m 2=0 

/3i,/3 m+ ieF2,ft+/3m+ie{o,i} 


( 12 ) 


( 13 ) 


Then, based on (fl2ll and (fT0l) . we are able to get 


Xt 7 0) 

m —1 

© n (Xi © bi ® l)(x m _)_j ® bi ® Si © 1) 

(to ,-*=0 

«=(<5o,-,«m-i)eO m (7) 


e n (Xi © bi © l){x m +i © bi) (Xi © bi © l)(x m +i © bi © 1) 

(to,■ ■ ■ ,£>rn —i)€:F™ ^esupp(t) i£zeros(<5) 

seo m h) 



/9i+/3m+i = l,i€supp(5) 


^i+/3m+ie{0,l},iezeros(5) 

© © ^ 

<5eO m (7) /3'+/3'V<5 


where zeros(a;) = {0 < i < n \ Xi = 0 } for x = (xq, ■ ■ • ,x n -\) £ and the third identity follows from (fl 2 l) 
and (fl3l) . 

Next we prove (fill) . Note the fact that x >z P™( 7 ) if and only if p™_ k (x) >r 7 for any x £ F™ and 
0 < k < to. Therefore, by the definition of O n (x) in J3]) we have {x £ F™ | x >z <5, <5 £ O m ( 7 )} = {a; £ 
F™ | x £ O m (6), 6 y 7 , 6 £ R m }. Then, we can rewrite (fTOl) as 

XT y (x) =0 0 cpx 0 (14) 

sen m p , +/3"eOm(S) 

where eg = c'p (mod 2 ) and c'p is the number of the term x 0 that appears in the right hand side of (1101) . 
i.e., c’o = \{6\j3’ + / 3 " >7 6,6 £ O m { 7 )}|. Still by the above fact, we have that ch is a constant for all 
/3' + ft" £ O m (6), which is denoted by c’ s for convenience, clearly = 1. Then we arrive at (fill) from (THl) 
where cs = c' s (mod 2 ) and c 7 = c 7 (mod 2 ) = 1 . □ 

Example 2. When n = 4, the ANFs of 0 x 0 and 0 x 0 , 6 £ F|, are given in Tabled 

/?'+/ 3 "ys P'+P"eo m ( 6 ) 


Table 2: The ANFs of 0 x 0 , 0 x 0 , 6 £ F? 

/3'+/3"t<5 /3'+/3"eO m (<5) 


6 

0 X? 

0'+p "ys 

0 x 0 

/ 3 '+/ 3 " eo m ( 5 ) 

(0,0) 

3 

1 0 ©fe ®XiX i+ 1 ) 
2=0 

1 

(1,0) 

3 

Xo 0 x 2 0 © X&i+i 
2=0 

® Xi 

2=0 

(0,1) 

3 

^ 10^3 0 © Z »® i +1 
2=0 

0 Xi 

2=0 

(1,1) 

3 

® £*® i+l 

2=0 

3 

© 

2=0 


Applying Lemma 0] to (O, we have 









Theorem 2. For the rotation symmetric bent function given in Theorem QJ its ANF is 


/oO)© 0 0 0 xP - 

7 eR m nr <5eo m (7) p'+p"ys 

As mentioned before, n/ 2 is the maximal algebraic degree of the n-variable bent function, which is usually 
of particular interest. 


Corollary 1. For the rotation symmetric bent function given in\7 J the algebraic degree arrives at the maximal 
value n/2 if and only if the size |T| ofT is odd. 


4 Rotation symmetric bent functions of any possible algebraic 
degree 


In this section, we study a flexible construction of n-variable rotation symmetric bent functions of any 
prescribed algebraic degree from 2 to n/2. We begin from a very useful linear combination of the n-variable 
characteristic functions \t~ (x) in (Ell- 

Lemma 5. For each S £ R m , there exists an nonempty subset As C R m such that 


© - S = 0 W,. 

P'+P"eO m (5) -y&As 


Proof. List all the vectors in R m according to the Hamming weight firstly and the lexicographic order 
secondly as 

Rm = {<* 1 ) ' ' ' , a|R m |} 
i.e., >£_ aj if i < j. Then, by (fill) we have 


{XT ai ,--- >Xr a|Rm| ) = ( 0 


0 


P’+p"eo m ( ai ) 


’+P "eo m (a |Rml ) 


( 1 0 
* 1 


V 


0 0 \ 
0 


1 0 

* 1 


Since the matrix is a lower triangular matrix of full rank, each (J) x& can be expressed as a linear 

/3'+/3"eo m (<5) 

combination of XT ai , • ■ • , Xt„ _ ■ □ 


S |Rml 


Based on Lemma O we can construct n-variable rotation symmetric bent function / with any algebraic 
degree 2 < deg(/) < n/2. 


Theorem 3. For any element S £ R m with wt(S) > 2, the function 

fo{x) © ( 0 x^ 

p'+p"eO m (6) 

is a rotation symmetric bent function with algebraic degree deg(/) = wt(<5), where /o is given in (fT|). 

Proof. The bent property of / is a direct consequence of <[9|), Theorem^ and LemmaO And deg(/) = wt(5) 
comes the fact that deg(x /3 ) = wt(/3) = wt(<5) for all /?' + ft" £ O m (5). 

□ 




By means of Theorem [3j we are able to construct more n- variable rotation symmetric bent functions by 

flexibly assembling some 0 . 

P'+P"eO m (6) 

Theorem 4. For any nonempty subset A C R m , the function 

fo(x) ® 0 ( 0 

<5eA j g' +/ 3" g o m (<S) 

is a rotation symmetric bent function, where jo is given in HD. 

Example 3. In m, for n = 2m = 6 r, Carlet et al. constructed an n-variable cubic rotation symmetric bent 
function as 

n— 1 2r—1 

f(x) = jo Or) © © XiX r -\-i%2r-\-i © 0 X i 2 r i 4r i 
i =0 i —0 

where fo(x) is given by JlJ. According to Theorem 1 in we know that /( x) can be rewritten as 

fix) = /o(a) © 0 x p 

p’+P"eo m {5) 

where 8 £ R m such that supp(<5) = {0,r, 2r}. In other words, the cubic rotation symmetric bent function in 
j 2 j/ is a simple case of our construction. 


Finally, we demonstrate a class of rotation symmetric bent functions by setting 

r i m) U (15) 

7<ERm, wt(7)—z 

where T 7 is given in ([HD and 0 < i < m. 

Lemma 6. The ANF of the n-variable characteristic function ofTin (HU) can be expressed as 


X r ( m > Or) — 0 0 


for all 0 < i < m. 

Proof. By <fTUl> and (fl5l) . we have 


wt(a)—j 

/ II n 

a. *Q: —U 


X r (m) (x) = 0 XT 7 (x) 


7 GRm 
wt( 7 )=z 


0 fT\ (T\ 

VL7 VL7 

7^Rm 5eOm{l) /3'+/3"y8 
wt(7 )=i 

= © © 

wt(<5)=i P'+P"h< 5 


= 0 


0 ^ 

wt(/3)=j 

p'*p"=o 


= 0 0 


3 hi wt (P)=j 
P'*0 "=0 


where the fourth identity holds since given any vector /3 £ FI? with wt(/3) = j for i < j < m, satisfying 
ft + ft' h 8 , we have that 




• wt(/3) = wt(/?' + /?"); 

• the number of distinct S with wt(5) = i satisfying f)' + (3" y S is Q), 

and the last identity holds by Lucas formula in (J^J) - □ 

From Theorem |T] Lemma [ 6 l © and (1151) . we obtain the following theorem. 

Theorem 5. For any set in USD. the function / 0 (x) © (J) (J) x a is a rotation symmetric bent 

jti wt (ot)=j 
a *ot"=0 

function with algebraic degree deg(/) = m, where fo is given in (fTl). 

5 Conclusion 

In this paper, for n = 2to, we proposed a systematic method for constructing n-variable rotation sym¬ 
metric bent functions with any given possible algebraic degrees ranging from 2 to m. 
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